huntrule

Windows Process Creation: TrolleyExpress.exe Used to Access lsass Memory (PID Parameters)

Alerts on command lines using TrolleyExpress.exe PID parameters consistent with LSASS memory dumping on Windows.

FreeReviewedSigma · High · v2
Product
windows
Category
process_creation
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-02-10
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion → Cred Access

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows process creation events where the command line includes TrolleyExpress.exe (or the path fragment) with parameters consistent with dumping another process by PID, specifically PID values in the 700–999 range. Using a whitelisted binary name to stage credential-access activity matters because it may help evade naive allowlists while attempting to obtain lsass memory contents. The detection relies on process creation telemetry, matching command-line substrings and confirming the image ends with TrolleyExpress.exe, while excluding cases based on OriginalFileName content.

Reporting behind it

Related detections9 linkedT1003.001 — drag to rearrange
Malicious LSASS Credential Dump via Rundll32 Comsvcs MiniDump via Process Creation (via process_creation)
Malicious LSASS Credential Dump via rundll32 and comsvcs MiniDump
Windows: NotPetya indicators via wevtutil log clearing, fsutil deletejournal, and rundll32 .dat/.zip.dll execution
Malicious Mimikatz Credential Dumping via Command Line Arguments
Suspicious Scheduled Task Executing Rundll32 DLL Export by Ordinal
Malicious Renamed Rundll32 Copied to Temp via Xcopy
Malicious Credential Extraction via Volatility Memory Analysis (via process_creation)
Suspicious Physical Memory Acquisition via WinPmem (via process_creation)
Suspicious rundll32 Executing DLL from ProgramData (via process_creation)
Windows Process Creation: TrolleyExpress.exe Used to Access lsass Memory (PID Parameters)
Pivot detection · T1003.001 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.